GitHub Security Advisories

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site...

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the...

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces...

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an...

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw...

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone...

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability:...

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow...

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node...

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed...

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and...

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token...

There is a information disclosure vulnerability in some Hikvision cameras, allowing...

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows...

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in...

There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect...

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic...

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow...

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature...

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}...

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux...

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains"...

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability...

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability...

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for...

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary...

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection...

A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This...

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM...

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's...

A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame...

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions...

The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor...

The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product...

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer...

The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload,...

The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site...

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration...

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new...

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A...

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does...

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and...

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to...

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function...

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is...

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a...

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who...

Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to...

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150...

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via...

Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed...

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects...

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially...

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected...

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information...

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via...

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning...

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote...

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive...

Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a...

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function...

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the...

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with...

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information...

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive...

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the...

Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker...

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution...

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the ...

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery...

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182...

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when...

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined...

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who...

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that...

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that...

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6...

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the...

Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to...

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182...

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker...

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal...

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal...

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component:...

Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal...

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud...

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll)....

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll...

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability...

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows...

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF...

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite ...

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll -...

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll -...

Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French...

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow...

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component:...

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal...

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality...